Allowlist-only export: the support bundle that can't overshare

The failure mode of flexible exporters

“Also attach a file of your choice” seems helpful — until a support case asks for Desktop\passwords.kdbx helpfully inclusively. Tools with free-form attach features inevitably leak because humans are helpful and phishing is good at its job.

The allowlist shape

• Fixed field list, enum-documented. Only named aggregates: OS product, build, edition; memory totals; probe statuses. Fields are added by schema version, never by request text.
• Negative capability, typed-enforced. No parameter exists that takes a path; no “include extra” hook; the exporter can't accept, let alone encode, an arbitrary byte stream.
• Right-sized redaction default. Omitted fields say excluded in the bundle, so a reviewer sees deliberate shape, not accidental gaps. See the emission pattern.

Product-grade trait: the preview flow shows the JSON on screen first and only writes a file when you pick a destination. If you can't preview it, don't ship it — the same rule for output as for configuration changes.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.